Java applet security model incompatibility between OS X JREs 6 and 7: any workaround?

Question

I am the author of Wordle , one of the few surviving Java applets in the wild.

Recently, I have received user reports about warnings that my (signed) applet will soon be blocked by the JRE because it clearly did not indicate the “Permissions” attribute in its manifest. So now MANIFEST.MF correctly points

Permissions: sandbox 

and the <applet> includes magic

  <param name="permissions" value="sandbox" /> 

param as documented .

Now, people who have leaned back to install OS X JRE 7 can easily run Wordle, but people (like many IT school administrators) who are stuck on JRE 6 cannot start the applet at all; they receive

 java.lang.SecurityException: JAR manifest requested to run in sandbox only: http://wordle.appspot.com/j/v1390/wordle.jar at com.sun.deploy.security.DeployManifestChecker.verify(DeployManifestChecker.java:106) at com.sun.deploy.security.DeployManifestChecker.verify(DeployManifestChecker.java:84) at com.sun.deploy.security.TrustDecider.isAllPermissionGranted(TrustDecider.java:319) at com.sun.deploy.security.TrustDecider.isAllPermissionGranted(TrustDecider.java:280) at com.sun.deploy.security.TrustDecider.isAllPermissionGranted(TrustDecider.java:270) at sun.plugin2.applet.Plugin2Manager.isAppletSigned(Plugin2Manager.java:3289) at sun.plugin2.applet.Plugin2Manager.createApplet(Plugin2Manager.java:3207) at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Plugin2Manager.java:1536) at java.lang.Thread.run(Thread.java:695)` 

The symptom assumes that the Java 6 plugin assumes that the signed applet should work in all-permissions mode and considers that the request for sandbox in the manifest is an error. In other words, it ignores the permissions parameter in the applet tag.

Does anyone know how to help my users besides installing the applet in all-permissions mode? I would rather stay in the sandbox because I don't want people to be afraid to use Wordle, and because I don't want to create an attack surface.

Answer 1

Apple's answer to my bug report.

Apple Developer Relations15-Aug-2014 05:12 PM

Engineering has determined that this is a problem for a third party based on the following:

This issue is related to the validation check of the Oracle manifest, which conflicts with the instructions that Oracle provided to developers to run applets in Java 7.

We installed Oracle Security SE 6 for security checks because they were developed in our version of Java SE 6. This is not compatible with the future version of Java, but there is nothing Apple will do to solve it because we no longer support Java SE 6 on 10.6. 8.

Now we close this error report.

If you have questions about resolving this issue, please update your bug report with this information.

Please check back regularly for new releases of Apple that might affect this issue.

In other words, they no longer support Apple Java (even if someone with OS X 10.6.8 or earlier has to use Apple Java), so they blame it on the original Oracle specification - apparently, Oracle didn’t follow, or the same an error will exist for Oracle Java 6.

Answer 2

Ok, I tried ANYTHING! If not all! I am sure there is NO WAY for the self-signed applet to work in sandbox mode with the latest update (1.6.0_65-b14-462-10M4609). The only chance I had was

• lower to 1.6.0_51
• remove permission tag and parameter completely from manifest and applet